Dataset details. We perform experiments on two common image classification datasets: CIFAR-10 [1]} which has \(32\times 32\)  images, and ImageNet-100 [2]} with \(224\times 224\)  images where we take each tenth class according to the WordNet ID order following [3]}. We choose ImageNet-100 instead of the full ImageNet since we have limited computation resources for performing grid searches on large-scale datasets over the main hyperparameters such as the perturbation radius for adversarial training or the standard deviation of the Gaussian noise.
